tools/toolsbeta: improve acme-chief integration
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	aborrero
	May 14 2020, 11:59 AM

Description

We identified several things to fix:

some toolforge puppet profiles use letsencrypt::cert::integrated. We would need to migrate to acme_chief::cert. Example: profile::toolforge::mailrelay
toolsbeta lacks support for running acme_chief. Among other things, we need a dedicated VM for that.
therefore, toolsbeta usually disables TLS, for example in the front-proxy we explicitly disable it. This would be good to improve, to make tools and toolsbeta more similar.

Also, worth noting there has been some conversations on IRC between @Krenair and @Andrew about simplifying the acme_chief setup in CloudVPS in general. Might be related to the problems described here.

Details

Subject	Repo	Branch	Lines +/-
toolforge: mailrelay: migrate TLS cert to acme-chief	operations/puppet	production	+7 -27
toolforge: mailrelay: introduce support for disabling TLS	operations/puppet	production	+24 -19
keystone: add service user toolsbeta-dns-manager	operations/puppet	production	+1 -0

Customize query in gerrit

Related Objects

Mentioned In: T120225: Toolforge: correctly envelope forwarded email
Mentioned Here: T252721: cloud-vps solution for Let's Encrypt
T252199: Stop using letsencrypt::cert::integrated
T252734: Consider moving tools away from acme-chief

Event Timeline

aborrero created this task.May 14 2020, 11:59 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 14 2020, 11:59 AM

aborrero mentioned this in T120225: Toolforge: correctly envelope forwarded email.May 14 2020, 12:02 PM

Mentioned in SAL (#wikimedia-cloud) [2020-05-14T12:08:39Z] <arturo> created toolsbeta-acme-chief-01 VM (T252762)

Mentioned in SAL (#wikimedia-cloud) [2020-05-14T12:09:20Z] <arturo> created puppet prefix toolsbeta-acme-chief in horizon (T252762)

do we really want to go down the path of setting acme-chief up in toolsbeta before doing the thing we agreed? I feel like this is basically motivated by T252199: Stop using letsencrypt::cert::integrated and its subtask, see also T252734: Consider moving tools away from acme-chief

Sorry, I forgot what thing we agreed on? Anyway, I agree with everything that simplifies the setup :-)

I'm kind of blocked by this. It would be interesting for me to deploy the email server in Toolsbeta this Q, but the TLS stuff needs work.
How can we collaborate in moving this forward?

PD: Feel free to merge this task to others, whatever you see fit

Change 597257 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] toolforge: mailrelay: introduce support for disabling TLS

https://gerrit.wikimedia.org/r/597257

gerritbot added a project: Patch-For-Review.May 19 2020, 10:53 AM

Change 597257 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] toolforge: mailrelay: introduce support for disabling TLS

https://gerrit.wikimedia.org/r/597257

Maintenance_bot removed a project: Patch-For-Review.May 19 2020, 11:10 AM

Andrew moved this task from Inbox to Needs discussion on the cloud-services-team (Kanban) board.May 19 2020, 4:10 PM

Dzahn unsubscribed.May 20 2020, 10:40 AM

I'm unblocked now. Closing this task in favor of whatever we decide on T252721: cloud-vps solution for Let's Encrypt.

we might still do this, we'll see :)

Krenair reopened this task as Open.May 27 2020, 8:54 PM

aborrero moved this task from Needs discussion to Soon! on the cloud-services-team (Kanban) board.Jun 10 2020, 3:36 PM

Change 604440 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] keystone: add service user toolsbeta-dns-manager

https://gerrit.wikimedia.org/r/604440

gerritbot added a project: Patch-For-Review.Jun 10 2020, 4:43 PM

Change 604440 merged by Andrew Bogott:
[operations/puppet@production] keystone: add service user toolsbeta-dns-manager

https://gerrit.wikimedia.org/r/604440

acme-chief is set up and working in toolsbeta now. I haven't actually consumed any of the certs or thought about what certs we need (right now the server is just making one for toolsbeta.wmflabs.org)

Maintenance_bot removed a project: Patch-For-Review.Jun 10 2020, 5:10 PM

Thanks!

We can close this task now and reopen if required later.

Change 607251 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] toolforge: mailrelay: migrate TLS cert to acme-chief

https://gerrit.wikimedia.org/r/607251

gerritbot added a project: Patch-For-Review.Jun 23 2020, 9:33 AM

Change 607251 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] toolforge: mailrelay: migrate TLS cert to acme-chief